Circular CSSF 19/714 is a CSSF circular, published 27 March 2019 and updated 30 June 2022. Subject: Update of Circular CSSF 17/654 on IT outsourcing relying on a cloud computing infrastructure. It was repealed by Circular CSSF 22/805.
\nRelevant for: Credit institutions, Investment firms, Payment institutions/electronic money institutions/AISPs, Specialised PFS, Support PFS.
\nIn case of discrepancies between the French and the English text, the French text shall prevail. Luxembourg, 27 March 2019 To all credit institutions and PFS 1 To all payment institutions and electronic money institutions 2 To all investment fund managers 3
\nCIRCULAR CSSF 19/714 Re:
\nUpdate of Circular CSSF 17/654 on IT outsourcing relying on a cloud computing infrastructure
\nLadies and Gentlemen, The purpose of this circular is to make substantial amendments to Circular CSSF 17/654, called “Cloud Circular” in order to take into account the experience gained by the CSSF and the supervised entities through its application since its entry into force in May 2017. Since the entry into force of Circular CSSF 17/654 in May 2017, the CSSF has noted the following facts:
\nMany authorisation or notification requests were submitted to the CSSF by the supervised entities in order to use cloud computing solutions. Two thirds of the intended cloud outsourcing fall under non-critical or non-material activities.
\nMany questions were addressed by the supervised entities to the CSSF. The supervised entities expressed, in that way, the need for more guidance from the CSSF, particularly with respect to the qualification of materiality of the outsourced activities.
\nIn December 2017, the European Banking Authority (EBA) published its Recommendations on outsourcing to cloud service providers (EBA/REC/2017/03). The CSSF assessed that Circular CSSF 17/654 includes the requirements laid down in the European texts but is stricter and less flexible in some aspects.
\nCircular CSSF 18/698 published in August 2018 made Circular CSSF 17/654 applicable to investment fund managers wishing to outsource to a cloud computing infrastructure.
\nAuthorised under the Law of 5 April 1993 on the financial sector (“LFS”). Authorised under the Law of 10 November 2009 on payment services (“LPS”). 3 Subject to Circular CSSF 18/698. 2
\nBased on these observations, the CSSF considers that the notification process for non-material outsourcing is too burdensome for supervised entities and for the CSSF and that more proportionality is needed for its treatment. Moreover, amendments made by Circular CSSF 18/698 must also be included in Circular CSSF 17/654. Therefore, the CSSF deems it necessary to make the following amendments to Circular CSSF 17/654: -
\nAddition of investment fund managers in the scope of application (in line with Circular CSSF 18/698);
\nReminder of the general principle of proportionality; in this context, introduction of optionality for some requirements for non-material activities only;
\nIntroduction of a register to be maintained by the supervised entities which includes all the cloud computing outsourcing of material as well as non-material activities;
\nCancellation of the necessity to notify the CSSF of a cloud computing outsourcing of non-material activities in favour of maintaining the register;
\nReplacement of the “compliance table” by more specific and pragmatic forms;
\nRewording and/or reorganisation of some paragraphs for more clarity (minor changes).
\nThis circular amends Circular CSSF 17/654 in many ways. In order to facilitate the reading and understanding, the amendments are presented in track changes (Annex). The CSSF will publish two documents helping to understand the topic on its website 4: -
\nA guide to assist the entities in qualifying the materiality of the activities;
\nAn FAQ to assist the entities in their analyses and procedures.
\nThe text above is the opening of the document; the PDF carries the whole.
\nDocument page, PDF. Source: Commission de Surveillance du Secteur Financier (CSSF), reproduced with the CSSF's consent. The French text prevails.
"}